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FIG. 3 





DETECTION ATTRIBUTE 


DETECTION 
THRESHOLD 


DETECTION 
TIME 


1 


{Dst=1 92. 168. 1.1/32. Protocol=TCP, Port=80} 


500 Kbps 


10 SECONDS 


2 


{Dst=1 92. 168. 1.2/32, Protocol=UDP} 


300 Kbps 


10 SECONDS 


3 


{Dst=1 92. 168. 1.0/24} 


1 Mbps 


20 SECONDS 



FIG. 4 



NORMAL CONDITION 



{Src=172.16.1 0.0/24} 



{TOS=0x01} 



FIG. 5 





ABNORMAL CONDITION 


1 


PACKETS AT 500 Kbps OR MORE ARE CONTINUOUSLY TRANSMITTED FOR 

30 SECONDS OR MORE 


2 


ICMP/Echo Reply PACKETS AT 300 Kbps OR MORE ARE 
CONTINUOUSLY TRANSMITTED FOR 15 SECONDS OR MORE 


3 


FRAGMENT PACKETS AT 300 Kbps OR MORE ARE 
CONTINUOUSLY TRANSMITTED FOR 15 SECONDS OR MORE 
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FIG. 7 




GENERATE NORMAL SIGNATURE 



± s 

GENERATE MALICIOUS SIGNATURE 



84 



1 



S5 



SET SUSPICIOUS SIGNATURE. NORMAL 
SIGNATURE.AND MALICIOUS SIGNATURE 
IN PACKET RESTRICTING UNIT 



1 



S6 



REPORT SUSPICIOUS SIGNATURE AND 
NORMAL SIGNATURE TO ADJACENT 
REPEATER DEVICE 
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FIG. 8 
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SET SUSPICIOUS SIGNATURE. NORMAL 
SIGNATURE AND MALICIOUS SIGNATURE 
IN PACKET RESTRICTING UNIT 
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Jl 



S13 



REPEAT SUSPICIOUS SIGNATURE AND 
NORMAL SIGNATURE TO ADJACENT 
REPEATER DEVICE 
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FIG. 17 





DETECTION ATTRIBUTE 


DETECTION 
THRESHOLD 


DETECTION 
TIME 


1 


{Dst=1 92. 1 68. 1 .1/32. Protocol=TCP, Port=80} 


500 kbps 


10 SECONDS 


2 


{Dst= 192. 168. 1.2/32. Protocol=UDP} 


300 kbps 


10 SECONDS 


3 


{Dst=1 92. 168. 1.0/24} 


1 Mbps 


20 SECONDS 



FIG. 18 





NORMAL CONDITION 


1 


{Src= 172. 16. 10.0/24} 


2 


{TOS=0x01} 



FIG. 19 





ABNORMAL CONDITION 


1 


PACKETS AT 500 kbps OR MORE ARE CONTINUOUSLY TRANSMITTED FOR 
30 SECONDS OR MORE 


2 


ICMP/Echo Reply PACKETS AT 300 kbps OR MORE ARE 
CONTINUOUSLY TRANSMITTED FOR 15 SECONDS OR MORE 


3 


FRAGMENT PACKETS AT 300 kbps OR MORE ARE 
CONTINUOUSLY TRANSMITTED FOR 15 SECONDS OR MORE 
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FIG. 21 
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GENERATE MALICIOUS SIGNATURE 
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AND NORMAL SIGNATURE TO 
ADJACENT REPEATER DEVICE 
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FIG. 22 
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SIGNATURE AND MALICIOUS SIGNATURE 
IN PACKET RESTRICTING UNIT 
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AND NORMAL SIGNATURE TO 
ADJACENT REPEATER DEVICE 
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